Privacy Policy

Who we are

Cash Winappio is a rewards app operated by Perkmedia LLC and distributed under the SmartFlutters brand. Perkmedia LLC is the data controller for the personal data described here — it decides why and how that data is used.

This policy explains what we collect, why, who we share it with, how long we keep it and what you can ask us to do about it. It covers winappio.net and the app on Google Play. It does not cover the games, surveys and offers supplied by partners, which have their own privacy policies.

Our role, and the role of SmartFlutters. Perkmedia LLC operates the service and decides why and how personal data is processed, so it acts as the data controller. SmartFlutters is the consumer brand through which the app is distributed and managed, together with the technical and support functions that keep it running. Where SmartFlutters handles personal data for us, it does so on our documented instructions and under a data processing agreement, and it may not use that data for its own purposes. Where SmartFlutters is simply the brand name under which Perkmedia LLC trades, the responsibility for the data remains with Perkmedia LLC as controller.

We do not sell personal data, and we do not share it with partners for their own advertising unless you have been told at the point the activity starts and have agreed to it there.

1. Information we collect

Account information. When you register by email or with Google we collect your email address, chosen username, country and an authentication record. If you sign in with Google we receive the basic profile details Google shares for that purpose.

Device and network data. IP address, operating system, device model, browser user agent and approximate region — used to keep sessions secure, detect fraud, and work out which activities are available where you are.

Activity and transaction records. Which offers you started or completed, survey participation, reward and Coin ledger entries, redemption requests and payout status. We keep these because a reward balance must be auditable.

Support correspondence. Messages you send us, so we can resolve an issue and keep a record of what was agreed.

We do not ask for special category data such as health information. Please do not send it to us.

2. Why we use your data, and our lawful basis

Contract — to create and run your account, credit Coins for confirmed activity, process redemptions and provide support. Without this we cannot deliver the service you signed up for.

Legitimate interests — to prevent fraud and abuse, secure the platform, keep a defensible audit trail of rewards and improve the product. These are balanced against your rights, and you may object (see section 7).

Consent — for analytics and marketing storage, where used. You choose in the cookie banner and can change your mind at any time from the Cookie settings link in the footer.

Legal obligation — where we must retain or disclose records to comply with law, answer a lawful request, or resolve a payment dispute.

3. Cookies and tracking

We use a small number of first-party cookies and similar technologies. Strictly necessary storage keeps you signed in and remembers your cookie choice and does not require consent. Analytics storage is activated only if you accept it. Our Cookie Policy sets out the categories and how to change your choice.

4. Who we share data with

Offer and survey partners. When you start an activity the partner needs an identifier so it can tell us whether it was genuinely completed. Partners receive only what is needed for attribution and fraud checking, and their own privacy policies also apply.

Advertising partners, for offers you choose to open. We do not sell your personal data.

Service providers who run the platform on our behalf — hosting, database, email delivery, analytics and anti-fraud. They act on our instructions under contract.

Payment and reward suppliers, when you redeem, so a reward can be issued.

Authorities, where we are legally required to disclose, or where it is necessary to investigate fraud or protect someone's safety.

5. International transfers

Some partners and providers are outside the country you live in, including outside the European Economic Area. Where data leaves the EEA we rely on an appropriate transfer mechanism — an adequacy decision by the European Commission, or Standard Contractual Clauses with the recipient. You can ask which mechanism applies to a particular transfer.

6. How long we keep it

Account data is kept while your account is open. Reward, redemption and payout records are kept after closure for as long as needed for accounting, tax and anti-fraud obligations, because a balance must be defensible if it is disputed.

Support correspondence is kept long enough to resolve the issue and handle follow-ups. Cookie choices are remembered for up to 180 days, after which we ask again.

7. Your rights

Subject to the conditions in data protection law, you can ask us to: access the personal data we hold about you and receive a copy; correct anything inaccurate; delete data where there is no overriding obligation to keep it; restrict or object to certain processing, including processing based on our legitimate interests; receive the data you gave us in a portable, machine-readable format; and withdraw consent at any time where processing is based on consent, without affecting processing already carried out.

You can also lodge a complaint with the data protection supervisory authority in the country where you live or work. We would prefer the chance to resolve it first, so please contact us.

Requests go through in-app support so we can verify the account belongs to you. We respond within the period required by law — one month as a general rule, extendable where a request is complex.

8. Security

Reward balances are protected by server-side validation: Coins are credited only when a partner confirms a genuine completion. Access to production data is restricted, and anti-fraud checks apply to redemption, including identity verification where required. No system is completely secure — if you believe your account has been compromised, contact support immediately.

9. Children

You must be at least 13 years old, or the minimum age of digital consent in your country if that is higher. Where local law requires a higher age for consent-based processing, we require that higher age. If we learn an account belongs to someone below the applicable age we will close it and delete data we are not required to keep.

10. Automated checks

We use automated fraud checks to decide whether to credit Coins or approve a redemption — for example detecting duplicate accounts, emulated devices or VPN use. That decision may be automated. You can ask for human review through in-app support.

12. Which laws apply

We apply the EU General Data Protection Regulation and the ePrivacy rules that accompany it to users in the European Union, and the UK GDPR and the Privacy and Electronic Communications Regulations to users in the United Kingdom. Because both are built on the same principles, we apply one standard across both rather than maintaining two regimes.

Where Moroccan law applies, we handle personal data consistently with Law 09-08 on the protection of individuals with regard to the processing of personal data, as administered by the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). Users in Morocco have the same rights described in section 7 and may also address the CNDP directly.

We also honour rights available under other applicable privacy laws for users in the jurisdictions we actually serve. Nothing in this policy reduces a right you have under the law that applies to you.

13. Data protection officer and EU representative

We have not appointed a statutory Data Protection Officer, because we do not consider that we meet the criteria that make one mandatory: we are not a public authority, we do not carry out large-scale systematic monitoring of publicly accessible areas, and we do not process special category data at scale as a core activity. Privacy questions are handled by the team reachable through in-app support.

If we are required to designate a representative in the European Union or the United Kingdom because we offer the service to users there from outside those territories, we will appoint one and publish the contact details here before that requirement takes effect. Until such details are published, please use in-app support, which reaches the responsible team directly.

14. Data processing agreements

Where a provider processes personal data on our behalf — hosting, database, email delivery, analytics, anti-fraud — we put a data processing agreement in place that limits processing to our documented instructions, requires confidentiality and security, governs sub-processors and requires deletion or return of data at the end of the relationship. The same applies to any group company that handles player data for us.

15. Changes to this policy

We update this policy as the service changes and will change the effective date when we do. Where a change materially affects how we use your data we will tell you in the app or by email before it takes effect. Effective date: 2 November 2026.

Contact

If you have a question about this document, or want to exercise a right described here, contact us through in-app support, which is the fastest route because it can see your account.

Our community is also on Discord — the invite is in the site footer.

The data controller is Perkmedia LLC, which operates Cash Winappio; the app is distributed under the SmartFlutters brand. Formal correspondence details are still being finalised; until they are published, please use in-app support so your request is logged against your account.